QLogs VIP 1575 MIX: 50,848 US Credentials Leaked in Largest Confirmed QLogs Batch (Aug 2025)

50,848 US Credentials: QLogs VIP 1575 MIX Is the Largest Confirmed Batch in the Series

Scale matters in stealer log analysis. QLogs VIP 1575 MIX 28-08-2025 landed August 30, 2025 carrying 50,848 US stealer log credentials across 1,575 individual endpoint files -- the largest confirmed QLogs batch by record count in the series documented here. At ~32.3 records per file, the yield sits squarely in the normal range for MIX-tier batches. But 1,575 compromised endpoints is a significaant operational footprint, and 50,848 immediately-usable plaintext credential pairs represent a substancial input for credential stuffing campaigns targeting US-based services.

QLogs VIP 1575 MIX (August 2025): Stealer Log Summary

• Records Exposed: 50,848
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: August 30, 2025

1,575 Endpoints: What a QLogs "MIX" Batch Looks Like at Scale

The MIX designation in QLogs naming typically signals a mixed consumer endpoint pool -- personal computers from a variety of geographic locations, device types, and infection vectors. At 1,575 files, this is QLogs operating at scale. Each file represents a unique compromised machine: a Windows endpoint that ran infostealer malware long enough to exfiltrate its saved browser credential store. The 50,848 records extracted break down to an average session yield of ~32.3 credentials per machine, consistent with what you'd expect from a broad consumer sweep rather than a targeted corporate intrusion. That consistency itself is informative -- the operator is running a high-volume, low-selectivity harvesting operation.

Late August 2025: QLogs at Peak Output

The August 28-30, 2025 window saw QLogs release at least five separate batches: VIP 900 MIX, VIP 940 MIX, VIP 1000 MIX (all on Aug 28), followed by this VIP 1575 MIX on Aug 30. Combined, those four batches account for more than 157,000 US credentials across 4,515 endpoints. This concentration of releases in a narrow window suggests either a scheduled drop cadence or a coordinated clearing of accumulated inventory. The VIP 1575 MIX, as the largest of the group, may represent a consolidation of multiple harvesting runs -- or simply the operator's largest active deployment.

Credential Stuffing Readiness: Why Plaintext Matters

Unlike database breaches where passwords are hashed, stealer log credentials arrive in plaintext -- exactly as the malware captured them from browser autofill and credential managers. There is no cracking step. A threat actor who obtains QLogs VIP 1575 MIX has 50,848 working email/password pairs tied to specific URLs, ready to be tested against login endpoints immediately. Password reuse across services amplifies the damage significantly: a single compromised password captured from a streaming service may unlock email, banking, or corporate SSO accounts if the victim reused it.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including stealer log credential sets like this QLogs VIP 1575 MIX batch. If your credentials were swept up in an infostealer campaign, you can find out now at HEROIC's breach scanner and take action before those credentials are used against you.